// admin_auth.go
package main

import (
	"net/http"
	"os"
)

type AdminAuth struct {
	users map[string]string
}

func newAdminAuthFromEnv() *AdminAuth {
	users := make(map[string]string)
	u1 := os.Getenv("ADMIN_USER")
	p1 := os.Getenv("ADMIN_PASS")
	if u1 != "" && p1 != "" {
		users[u1] = p1
	}
	u2 := os.Getenv("ADMIN_USER2")
	p2 := os.Getenv("ADMIN_PASS2")
	if u2 != "" && p2 != "" {
		users[u2] = p2
	}
	return &AdminAuth{users: users}
}

func (a *AdminAuth) requireAdmin(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		user, pass, ok := r.BasicAuth()
		if !ok {
			w.Header().Set("WWW-Authenticate", "Basic realm=\"bridge-admin\"")
			w.WriteHeader(http.StatusUnauthorized)
			return
		}
		expected, ok := a.users[user]
		if !ok || expected != pass {
			w.Header().Set("WWW-Authenticate", "Basic realm=\"bridge-admin\"")
			w.WriteHeader(http.StatusUnauthorized)
			return
		}
		next.ServeHTTP(w, r)
	})
}